#-------------------------------------------------------------------------------
# Name:        Log
# Purpose: Thu muc log
#
# Author:      Mr.Junz-N
#
# Created:     10/12/2012
# Copyright:   (c) Mr.Junz-N 2012
# Licence:     <1.0>
#-------------------------------------------------------------------------------

from MongoDB import Connect
import re
import LogFiles as LF
from Detect import Payload
from Detect import Fuzz
import time

axName = {
    r"date"             : r"Date",
    r"time"             : r"Time",
    r's-ip'             : r"ServerIP",
    r'cs-method'        : r"Method",
    r'cs-uri-stem'      : r'Path',
    r'cs-uri-query'     : r'Query',
    r's-port'           : r'Port',
    r'cs-username'      : r'Username',
    r'c-ip'             : r'ClientIP',
    r'cs(User-Agent)'   : r'UserAgent',
    r'sc-status'        : r'Status',
    r'sc-substatus'     : r'SubStatus',
    r'sc-win32-status'  : r'Win32Status',
    r'time-taken\n'     : r'TimeTaken',
}

# Mang chua cac Pattern cua cac chuan nhan biet Log
arrDetect = {
    "W3C"                   : [ r'#Software:(?P<VersionIIS>.+)'],
    "NCSA"                  : [ r'(?P<ClientIP>\S+)\s+(?P<Authentication>\S+)\s+(?P<Username>\S+)\s+\[(?P<Date>.{10,12}):(?P<Time>.{8})\s(?P<TimeZone>.+)\s*\]\s+"(?P<Method>.+)\s+(?P<URL>.+)\s+(?P<HTTP>.+)"\s+(?P<Status>[0-9]+)\s+(?P<Size>\S+)\s+"(?P<Reference>.+)"\s+"(?P<UserAgent>.*)"\s+(?P<Win32Status>[0-9]+)\s+(?P<TimeTaken>[0-9]+)\s*\Z',
                                r'(?P<ClientIP>\S+)\s+(?P<Authentication>\S+)\s+(?P<Username>\S+)\s+\[(?P<Date>.{10,12}):(?P<Time>.{8})\s*\]\s+"(?P<Method>.+)\s+(?P<URL>.+)\s+(?P<HTTP>.+)"\s+(?P<Status>[0-9]+)\s+(?P<Size>\S+)\s+"(?P<Reference>.+)"\s+"(?P<UserAgent>.+)"\s+(?P<Win32Status>[0-9]+)\s+(?P<TimeTaken>[0-9]+)\s*\Z',
                                r'(?P<ClientIP>\S+)\s+(?P<Authentication>\S+)\s+(?P<Username>\S+)\s+\[(?P<Date>.{10,12}):(?P<Time>.{8})\s+(?P<TimeZone>.+)\]\s+"(?P<Method>.+)\s+(?P<URL>.+)\s+(?P<HTTP>.+)"\s+(?P<Status>[0-9]+)\s+(?P<Size>\S+)\s+"(?P<Reference>.*)"\s+"(?P<UserAgent>.*)"\s*\Z',
                                r'(?P<ClientIP>\S+)\s+(?P<Authentication>\S+)\s+(?P<Username>\S+)\s+\[(?P<Date>.{10,12}):(?P<Time>.{8})\s*\]\s+"(?P<Method>.+)\s+(?P<URL>.+)\s+(?P<HTTP>.+)"\s+(?P<Status>[0-9]+)\s+(?P<Size>\S+)\s+"(?P<Reference>.*)"\s+"(?P<UserAgent>.*)"\s*\Z',
                                r'(?P<ClientIP>\S+)\s+(?P<Authentication>\S+)\s+(?P<Username>\S+)\s+\[(?P<Date>.{10,12}):(?P<Time>.{8})\s+(?P<TimeZone>.+)\]\s+"(?P<Method>.+)\s+(?P<URL>.+)\s+(?P<HTTP>.+)"\s+(?P<Status>[0-9]+)\s+(?P<Size>\S+)\s*\Z',
                                r'(?P<ClientIP>\S+)\s+(?P<Authentication>\S+)\s+(?P<Username>\S+)\s+\[(?P<Date>.{10,12}):(?P<Time>.{8})\s*\]\s+"(?P<Method>.+)\s+(?P<URL>.+)\s+(?P<HTTP>.+)"\s+(?P<Status>[0-9]+)\s+(?P<Size>\S+)\s*\Z',
                                r'(?P<ClientIP>\S+)\s+(?P<Authentication>\S+)\s+(?P<Username>\S+)\s+\[(?P<Date>.{10,12}):(?P<Time>.{8})\s+(?P<TimeZone>.+)\]\s+"(?P<Method>.+)\s+(?P<URL>.+)\s+(?P<HTTP>.+)"\s+(?P<Status>[0-9]+)\s+(?P<Size>\S+)\s+"(?P<Reference>.*)"\s*\Z',
                                r'(?P<ClientIP>\S+)\s+(?P<Authentication>\S+)\s+(?P<Username>\S+)\s+\[(?P<Date>.{10,12}):(?P<Time>.{8})\s*\]\s+"(?P<Method>.+)\s+(?P<URL>.+)\s+(?P<HTTP>.+)"\s+(?P<Status>[0-9]+)\s+(?P<Size>\S+)\s+"(?P<Reference>.*)"\s*\Z',

                                ],
    "IISLog"                : [ r'XXXX'],
    "EventLog"              : [ r'XXXX'],
    "Mysqld"                : [ r'(?P<Date>.{10,12}):(?P<Time>.{8})[:|,](?P<Unknow>.+)\s+\[(?P<CRITICAL>.+)\]\s+(?P<Message>.+)'],
    "Syslog"                : [ r'XXXX'],
    "Others"                : [ r'XXXX'],

    }
partternField_IIS = r'\((?P<Field>)\)'

class Log:
    """Thuc hien viec xac dinh chuan Log - Tach va thuc hien viec luu Log vao co so du lieu"""

    def __init__(self):
        self.PLoad = Payload.Payloads().Vulns
        #self.nameStandardLog = None
        #self.versionLog      = None
        #self.visitPattern    = -1
       # self.db = Connect.Database()
      #  self.db.Connect()
        return

    #////////////////////////////////////////////
    # Luu Log vao CSDL
    # @ List of Fields
    #
    #////////////////////////////////////////////
    def SaveLog(self, listLogs = []):
        fuzz = Fuzz.Fuzz()
        self.nameStandardLog = self.DetectTypeLog(listLogs[0])
        print self.nameStandardLog
        #print listLogs[0]
        if (self.nameStandardLog == "W3C"):
            self.listFields = listLogs[3].split(" ")
            self.listFields = self.preFields(self.listFields)
            del self.listFields[0]
            # print self.listFields
            del listLogs[0:4]
            for lineLog in listLogs:
                tmpDictLog = dict(zip(self.listFields, lineLog.split(r' ')))
                #tmpDictLog = self.preDocument(tmpDictLog)
                print tmpDictLog["URL"]
                fuzz.DtVulns(tmpDictLog["Path"], tmpDictLog["Query"],tmpDictLog["Status"])

              #  self.db.InsertDocument(tmpDictLog)

        elif(self.nameStandardLog == "NCSA"):
            for lineLog in listLogs:
                matchPattern = re.match(arrDetect[self.nameStandardLog][self.visitPattern], lineLog)
                try:
                    tmpDictLog = matchPattern.groupdict()
                except:
                    print lineLog
                    #print "Exception"
                    pass
               # tmpDictLog = self.preDocument(tmpDictLog)
                tmpDictLog["Path"] = tmpDictLog["URL"].split("?")[0]
                try:
                    tmpDictLog["Query"] = tmpDictLog["URL"].split("?")[1]
                except:
                    #print "Exception"
                    tmpDictLog["Query"] = None
                #print tmpDictLog
                fuzz.DtVulns(tmpDictLog["Path"], tmpDictLog["Query"],tmpDictLog["Status"])

                #self.db.InsertDocument(tmpDictLog)
            pass
        elif(self.nameStandardLog == "IIS"):
            for lineLog in listLogs:
                matchPattern = re.match(arrDetect[self.nameStandardLog][self.visitPattern], lineLog)
                try:
                    tmpDictLog = matchPattern.groupdict()
                except:
                    print lineLog
               # tmpDictLog = self.preDocument(tmpDictLog)
                tmpDictLog["Path"] = tmpDictLog["URL"].split("?")[0]
                tmpDictLog["Query"] = tmpDictLog["URL"].split("?")[1]
                fuzz.DtVulns(tmpDictLog["Path"], tmpDictLog["Query"],tmpDictLog["Status"])
                #self.db.InsertDocument(tmpDictLog)
            pass
        elif(self.nameStandardLog == "EventLog"):
            pass
        elif(self.nameStandardLog == "Mysqld"):
            for lineLog in listLogs:
                matchPattern = re.match(arrDetect[self.nameStandardLog][self.visitPattern], lineLog)
                try:
                    tmpDictLog = matchPattern.groupdict()
                except:
                    print lineLog
               # tmpDictLog = self.preDocument(tmpDictLog)
                #print tmpDictLog
                #self.db.InsertDocument(tmpDictLog)
            pass
        elif(self.nameStandardLog == "Syslog"):
            pass
        elif(self.nameStandardLog == "Others"):
            pass
        else:
            pass
        return

    #////////////////////////////////////////////
    # Bo dau ngoac giua cua Fields
    # @ List of Fields
    #
    #////////////////////////////////////////////
    def preFields(self, Fields = []):
        # Xu ly cac truong truoc khi thuc hien viet luu hoac canh bao
       return Fields

    #////////////////////////////////////////////
    # Bo dau ngoac giua cua Fields
    # @ List of Fields
    #
    #////////////////////////////////////////////
    def preDocument(self, tmpDocs = {}):
        for key, value in tmpDocs.items():
            if (value == r'-'):
                tmpDocs[key] = None
        return tmpDocs

    #////////////////////////////////////////////
    # Mau nhan dang log
    # @ First Line of Log
    #
    #////////////////////////////////////////////
    def DetectTypeLog(self, FirstLine):
        print FirstLine
        for key in arrDetect.keys():
            self.visitPattern = -1
            for pattern in arrDetect[key]:
               # print pattern
                matchPattern = re.match(pattern, FirstLine)
                self.visitPattern = self.visitPattern + 1
                if (matchPattern!= None):
                    dictLog = matchPattern.groupdict()
                    #print 1
                    #if (dictLog["VersionIIS"] != None):
                    # self.versionLog = dictLog["VersionIIS"]
                    self.nameStandardLog = key
                    return key
        return None
    # Tac cac thanh phan tuong ung
    def Analyzer(self):

        return

def main():
    print time.clock()
    log = Log()
    #log.DetectTypeLog("#Software: Microsoft Internet Information Services 7.5")
    logF = LF.LogFiles()
    #print log.DetectTypeLog(r"28/Nov/2012:14:00:41:196 [CRITICAL] /opt/mysql/bin/mysqld: Disk is full writing '/mysqllog/binlog/localhost-3306-bin.000020' (Errcode: 28). Waiting for someone to free space... Retry in 60 secs")
    #print log.visitPattern
    log.SaveLog(logF.getListLogs("access.log"))
    print log.nameStandardLog
    print log.visitPattern
    """log.SaveLog(logF.getListLogs("access_combined2.log"))
    print log.nameStandardLog
    print log.visitPattern
    log.SaveLog(logF.getListLogs("access_combined3.log"))
    print log.nameStandardLog
    print log.visitPattern
    log.SaveLog(logF.getListLogs("access_combined4.log"))
    print log.nameStandardLog
    print log.visitPattern
    log.SaveLog(logF.getListLogs("access_combined5.log"))
    print log.nameStandardLog
    print log.visitPattern
    log.SaveLog(logF.getListLogs("access_combined6.log"))
    print log.nameStandardLog
    print log.visitPattern
    log.SaveLog(logF.getListLogs("access_combined7.log"))
    print log.nameStandardLog
    print log.visitPattern
    log.SaveLog(logF.getListLogs("access_combined3.log"))
    print log.nameStandardLog
    print log.visitPattern
    log.SaveLog(logF.getListLogs("access.log"))
    print log.nameStandardLog
    print log.visitPattern
    log.SaveLog(logF.getListLogs("u_ex121206.log"))
    print log.nameStandardLog
    print log.visitPattern"""
    pass

if __name__ == '__main__':
    main()
